diff --git a/.gitignore b/.gitignore index a49786601..512cf660c 100644 --- a/.gitignore +++ b/.gitignore @@ -56,3 +56,12 @@ coverage/ test-driver nbproject/ *.[si] +*.apk +*.aab +*.apks +*.idsig +*.jks +*.keystore +src/frontends/android/app/src/main/jni/openssl/ +src/frontends/android/local.properties +*.hprof diff --git a/src/frontends/android/.gitignore b/src/frontends/android/.gitignore index aeb7cd7ab..db48abec5 100644 --- a/src/frontends/android/.gitignore +++ b/src/frontends/android/.gitignore @@ -4,5 +4,12 @@ build/ app/build/ app/src/main/libs app/src/main/obj +app/src/main/jni/openssl/ *.iml local.properties +*.apk +*.aab +*.apks +*.idsig +*.jks +*.keystore diff --git a/src/frontends/android/app/build.gradle b/src/frontends/android/app/build.gradle index 3e883bc1a..e69de29bb 100644 --- a/src/frontends/android/app/build.gradle +++ b/src/frontends/android/app/build.gradle @@ -1,57 +0,0 @@ -apply plugin: 'com.android.application' - -android { - namespace = 'org.strongswan.android' - - defaultConfig { - applicationId "org.strongswan.android" - compileSdk = 36 - minSdkVersion 21 - targetSdkVersion 36 - - versionCode 96 - versionName "2.6.2" - - externalNativeBuild { - ndkBuild { - arguments '-j' + Runtime.runtime.availableProcessors() - } - } - } - - ndkVersion = "27.3.13750724" - - externalNativeBuild { - ndkBuild { - path 'src/main/jni/Android.mk' - } - } - - tasks.withType(JavaCompile).configureEach { - compileTask -> - options.compilerArgs << "-Xlint:unchecked" << "-Xlint:deprecation" - } - - buildTypes { - release { - minifyEnabled false - proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.txt' - } - } - compileOptions { - targetCompatibility 1.8 - sourceCompatibility 1.8 - } -} - -dependencies { - implementation 'androidx.appcompat:appcompat:1.7.1' - implementation 'androidx.core:core:1.17.0' - implementation 'androidx.lifecycle:lifecycle-process:2.9.4' - implementation 'androidx.preference:preference:1.2.1' - implementation 'androidx.localbroadcastmanager:localbroadcastmanager:1.1.0' - implementation 'com.google.android.material:material:1.13.0' - testImplementation 'junit:junit:4.13.2' - testImplementation 'org.assertj:assertj-core:3.27.6' - testImplementation 'org.mockito:mockito-core:5.20.0' -} diff --git a/src/frontends/android/app/proguard-rules.txt b/src/frontends/android/app/proguard-rules.txt new file mode 100644 index 000000000..2def79d82 --- /dev/null +++ b/src/frontends/android/app/proguard-rules.txt @@ -0,0 +1,60 @@ +# SHX VPN R8 rules +# +# The native library (libandroidbridge) looks up Java classes and methods by +# name via JNI. R8 must not rename or remove any of them. + +# --- JNI entry points called from native code by name --- + +-keep class org.strongswan.android.logic.CharonVpnService { + *; +} +# inner class BuilderAdapter is called from vpnservice_builder.c +-keep class org.strongswan.android.logic.CharonVpnService$BuilderAdapter { + *; +} +-keep class org.strongswan.android.logic.SimpleFetcher { + *; +} +-keep class org.strongswan.android.logic.NetworkManager { + *; +} +-keep class org.strongswan.android.logic.Scheduler { + *; +} +-keep class org.strongswan.android.logic.imc.AndroidImc { + *; +} + +# native methods (and classes containing them) must keep their names +-keepclasseswithmembernames class * { + native ; +} + +# --- Content providers exported to other apps --- + +-keep class org.strongswan.android.data.LogContentProvider { + *; +} + +# --- Parcelable CREATORs (RemediationInstruction etc.) --- + +-keepclassmembers class * implements android.os.Parcelable { + public static final ** CREATOR; +} + +# --- Enum values used via valueOf/values (VpnType, State, ErrorState...) --- + +-keepclassmembers enum * { + public static **[] values(); + public static ** valueOf(java.lang.String); +} + +# --- WebView / TextView reflection-free; keep line numbers for readable +# crash reports in released APKs --- + +-keepattributes SourceFile,LineNumberTable +-renamesourcefileattribute SourceFile + +# --- squash warnings for optional dependencies referenced only from XML --- + +-dontwarn org.bouncycastle.jsse.util.** diff --git a/src/frontends/android/app/src/androidTest/java/org/strongswan/android/ui/compose/SettingsScreenTest.kt b/src/frontends/android/app/src/androidTest/java/org/strongswan/android/ui/compose/SettingsScreenTest.kt new file mode 100644 index 000000000..ff25785cf --- /dev/null +++ b/src/frontends/android/app/src/androidTest/java/org/strongswan/android/ui/compose/SettingsScreenTest.kt @@ -0,0 +1,80 @@ +/* + * Copyright (C) 2026 SHX VPN + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See . + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +package org.strongswan.android.ui.compose + +import androidx.compose.ui.test.assertIsDisplayed +import androidx.compose.ui.test.junit4.createComposeRule +import androidx.compose.ui.test.onNodeWithText +import androidx.compose.ui.test.onAllNodesWithText +import androidx.test.platform.app.InstrumentationRegistry +import org.junit.Rule +import org.junit.Test +import org.strongswan.android.R +import org.strongswan.android.ui.compose.theme.ShxTheme + +class SettingsScreenTest +{ + @get:Rule + val composeRule = createComposeRule() + + private fun string(id: Int): String = + InstrumentationRegistry.getInstrumentation().targetContext.getString(id) + + private fun setContent() + { + composeRule.setContent { + ShxTheme { + SettingsScreen(profiles = emptyList()) + } + } + composeRule.waitForIdle() + } + + @Test + fun showsSectionHeaders() + { + setContent() + composeRule.onNodeWithText( + string(R.string.settings_section_automation) + ).assertIsDisplayed() + composeRule.onNodeWithText( + string(R.string.settings_section_security) + ).assertIsDisplayed() + composeRule.onNodeWithText( + string(R.string.settings_section_support) + ).assertIsDisplayed() + } + + @Test + fun showsTrustedNetworksEntry() + { + setContent() + composeRule.onNodeWithText( + string(R.string.auto_connect_title) + ).assertIsDisplayed() + } + + @Test + fun showsKillSwitchEntry() + { + setContent() + composeRule.onNodeWithText( + string(R.string.kill_switch_title) + ).assertIsDisplayed() + composeRule.onAllNodesWithText( + string(R.string.kill_switch_summary_off) + ).fetchSemanticsNodes().isNotEmpty() + } +} diff --git a/src/frontends/android/app/src/androidTest/java/org/strongswan/android/ui/compose/TrustedNetworksScreenTest.kt b/src/frontends/android/app/src/androidTest/java/org/strongswan/android/ui/compose/TrustedNetworksScreenTest.kt new file mode 100644 index 000000000..f2eed364c --- /dev/null +++ b/src/frontends/android/app/src/androidTest/java/org/strongswan/android/ui/compose/TrustedNetworksScreenTest.kt @@ -0,0 +1,82 @@ +/* + * Copyright (C) 2026 SHX VPN + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See . + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +package org.strongswan.android.ui.compose + +import androidx.compose.ui.test.assertIsDisplayed +import androidx.compose.ui.test.junit4.createComposeRule +import androidx.compose.ui.test.onNodeWithText +import androidx.test.platform.app.InstrumentationRegistry +import org.junit.Rule +import org.junit.Test +import org.strongswan.android.R +import org.strongswan.android.ui.compose.theme.ShxTheme + +class TrustedNetworksScreenTest +{ + @get:Rule + val composeRule = createComposeRule() + + private fun string(id: Int): String = + InstrumentationRegistry.getInstrumentation().targetContext.getString(id) + + private fun setContent() + { + composeRule.setContent { + ShxTheme { + TrustedNetworksScreen(profiles = emptyList(), currentSsid = null) + } + } + composeRule.waitForIdle() + } + + @Test + fun showsMasterToggle() + { + setContent() + composeRule.onNodeWithText( + string(R.string.auto_connect_title) + ).assertIsDisplayed() + composeRule.onNodeWithText( + string(R.string.auto_connect_summary) + ).assertIsDisplayed() + } + + @Test + fun showsProfilePickerRow() + { + setContent() + composeRule.onNodeWithText( + string(R.string.auto_connect_profile) + ).assertIsDisplayed() + } + + @Test + fun showsEmptyTrustedList() + { + setContent() + composeRule.onNodeWithText( + string(R.string.auto_connect_no_networks) + ).assertIsDisplayed() + } + + @Test + fun showsAddNetworkButton() + { + setContent() + composeRule.onNodeWithText( + string(R.string.auto_connect_add_network) + ).assertIsDisplayed() + } +} diff --git a/src/frontends/android/app/src/main/AndroidManifest.xml b/src/frontends/android/app/src/main/AndroidManifest.xml index c0a8ed484..ef090e845 100644 --- a/src/frontends/android/app/src/main/AndroidManifest.xml +++ b/src/frontends/android/app/src/main/AndroidManifest.xml @@ -21,12 +21,23 @@ + + + + + + + + @@ -61,11 +72,11 @@ android:launchMode="singleTask" android:exported="true"> - + - + @@ -85,12 +96,17 @@ android:label="@string/log_title" > - + android:name=".ui.SettingsActivity" + android:label="@string/pref_title"> + + + + android:label="@string/remediation_instructions_title" + android:theme="@style/ApplicationTheme.ActionBar" > @@ -202,7 +219,7 @@ - - - - - - - - - - - - - - - - - diff --git a/src/frontends/android/app/src/main/res/layout/main.xml b/src/frontends/android/app/src/main/res/layout/main.xml deleted file mode 100644 index 06932866f..000000000 --- a/src/frontends/android/app/src/main/res/layout/main.xml +++ /dev/null @@ -1,42 +0,0 @@ - - - - - - - - - - - diff --git a/src/frontends/android/app/src/main/res/layout/profile_list_fragment.xml b/src/frontends/android/app/src/main/res/layout/profile_list_fragment.xml deleted file mode 100644 index 9878147f5..000000000 --- a/src/frontends/android/app/src/main/res/layout/profile_list_fragment.xml +++ /dev/null @@ -1,41 +0,0 @@ - - - - - - - - - diff --git a/src/frontends/android/app/src/main/res/layout/profile_list_item.xml b/src/frontends/android/app/src/main/res/layout/profile_list_item.xml deleted file mode 100644 index d4d9b651e..000000000 --- a/src/frontends/android/app/src/main/res/layout/profile_list_item.xml +++ /dev/null @@ -1,76 +0,0 @@ - - - - - - - - - - - - - - - diff --git a/src/frontends/android/app/src/main/res/layout/vpn_state_fragment.xml b/src/frontends/android/app/src/main/res/layout/vpn_state_fragment.xml deleted file mode 100644 index b3d8cfdc6..000000000 --- a/src/frontends/android/app/src/main/res/layout/vpn_state_fragment.xml +++ /dev/null @@ -1,156 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/src/frontends/android/app/src/main/res/menu/main.xml b/src/frontends/android/app/src/main/res/menu/main.xml deleted file mode 100644 index 97a2beab9..000000000 --- a/src/frontends/android/app/src/main/res/menu/main.xml +++ /dev/null @@ -1,45 +0,0 @@ - - - - - - - - - - - - - - - diff --git a/src/frontends/android/app/src/main/res/menu/profile_list.xml b/src/frontends/android/app/src/main/res/menu/profile_list.xml deleted file mode 100644 index a0dde1d63..000000000 --- a/src/frontends/android/app/src/main/res/menu/profile_list.xml +++ /dev/null @@ -1,24 +0,0 @@ - - - - - - - diff --git a/src/frontends/android/app/src/main/res/menu/profile_list_context.xml b/src/frontends/android/app/src/main/res/menu/profile_list_context.xml deleted file mode 100644 index a4e864190..000000000 --- a/src/frontends/android/app/src/main/res/menu/profile_list_context.xml +++ /dev/null @@ -1,28 +0,0 @@ - - - - - - - - - - - diff --git a/src/frontends/android/app/src/main/res/values-de/strings.xml b/src/frontends/android/app/src/main/res/values-de/strings.xml index c282004af..0b21115dd 100644 --- a/src/frontends/android/app/src/main/res/values-de/strings.xml +++ b/src/frontends/android/app/src/main/res/values-de/strings.xml @@ -19,8 +19,8 @@ - strongSwan VPN Client - strongSwan + SHX VPN + SHX VPN Log anzeigen Suchen VPN nicht unterstützt @@ -29,7 +29,7 @@ Keine Berechtigung, um VPN Verbindungen zu erstellen. Entweder weil diese vom Benutzer verweigert wurde oder weil für eine andere VPN Anwendung der Always-On-Modus aktiviert ist. Laden… Profil nicht gefunden - strongSwan-Verknüpfung + SHX VPN-Verknüpfung VPN Verbindungsstatus Zeigt Informationen zum Verbindungsstatus der VPN Verbindung und dient als permanente Notification dazu, den VPN Dienst im Hintergrund am Laufen zu halten. diff --git a/src/frontends/android/app/src/main/res/values-night/bools.xml b/src/frontends/android/app/src/main/res/values-night/bools.xml new file mode 100644 index 000000000..8b1378917 --- /dev/null +++ b/src/frontends/android/app/src/main/res/values-night/bools.xml @@ -0,0 +1 @@ + diff --git a/src/frontends/android/app/src/main/res/values-night/colors.xml b/src/frontends/android/app/src/main/res/values-night/colors.xml new file mode 100644 index 000000000..8b1378917 --- /dev/null +++ b/src/frontends/android/app/src/main/res/values-night/colors.xml @@ -0,0 +1 @@ + diff --git a/src/frontends/android/app/src/main/res/values-pl/strings.xml b/src/frontends/android/app/src/main/res/values-pl/strings.xml index 82d965536..8d63c3c76 100644 --- a/src/frontends/android/app/src/main/res/values-pl/strings.xml +++ b/src/frontends/android/app/src/main/res/values-pl/strings.xml @@ -21,8 +21,8 @@ - strongSwan klient VPN - strongSwan + SHX VPN + SHX VPN Pokaż log Szukaj Nie obsługiwany VPN @@ -31,7 +31,7 @@ Unable to get permission to create VPN connections. Either because it was denied by the user, or because a different VPN app has the always-on feature enabled. Wczytywanie… Nie znaleziono profilu - Skrót strongSwan + Skrót SHX VPN VPN connection state Provides information about the VPN connection state and serves as permanent notification to keep the VPN service running in the background. diff --git a/src/frontends/android/app/src/main/res/values-ru/arrays.xml b/src/frontends/android/app/src/main/res/values-ru/arrays.xml index 64c234eb4..42f14e74e 100644 --- a/src/frontends/android/app/src/main/res/values-ru/arrays.xml +++ b/src/frontends/android/app/src/main/res/values-ru/arrays.xml @@ -24,8 +24,8 @@ - All applications use the VPN - Exclude selected applications from the VPN - Only selected applications use the VPN + Все приложения используют VPN + Исключить выбранные приложения из VPN + Только выбранные приложения используют VPN diff --git a/src/frontends/android/app/src/main/res/values-ru/strings.xml b/src/frontends/android/app/src/main/res/values-ru/strings.xml index ac09e3e4c..fc1bacf1d 100644 --- a/src/frontends/android/app/src/main/res/values-ru/strings.xml +++ b/src/frontends/android/app/src/main/res/values-ru/strings.xml @@ -15,8 +15,8 @@ - Клиент strongSwan VPN - strongSwan + SHX VPN + SHX VPN Журнал Поиск VPN не поддерживается @@ -25,16 +25,16 @@ Unable to get permission to create VPN connections. Either because it was denied by the user, or because a different VPN app has the always-on feature enabled. Загрузка… Профиль не найден - Ссылка на strongSwan + Ярлык SHX VPN VPN connection state Provides information about the VPN connection state and serves as permanent notification to keep the VPN service running in the background. - Settings - Default VPN profile - Connect to most recently used profile - Ignore battery optimizations - Don\'t show a warning if the app is not on the device\'s power whitelist + Настройки + Профиль по умолчанию + Последний использованный профиль + Игнорировать оптимизацию батареи + Не предупреждать, если приложение не в белом списке энергосбережения Журнал @@ -57,36 +57,36 @@ Сохранить - Import + Импорт Отмена Название профиля (необязательный) Название профиля - Defaults to the configured server - Defaults to \"%1$s\" + По умолчанию — адрес сервера + По умолчанию «%1$s» Сервер - IP address or hostname of the VPN server + IP-адрес или имя хоста VPN-сервера VPN Тип Логин Пароль (необязательный) - Leave blank to get prompted on demand + Оставьте пустым, чтобы спросить при подключении Сертификат пользователя Выбрать сертификат пользователя Выбрать сертификат пользователя - Install user certificate + Установить сертификат пользователя Сертификат CA Выбрать автоматически Выбрать сертификат CA Выбрать CA сертификат - Advanced settings - Show advanced settings - Server identity - Defaults to the configured server. Custom values are explicitly sent to the server and enforced during authentication - Defaults to \"%1$s\". Custom values are explicitly sent to the server and enforced during authentication - Client identity - Defaults to the configured username. Custom values may be used if expected/required by the server - Defaults to the certificate\'s subject identity. Custom values may be used if expected/required by the server. Note that these usually must be confirmed by the certificate (auto-completion is provided for the certificate\'s alternative identities, if any) - DNS servers - Custom DNS servers to use when connected to the VPN (separated by spaces, e.g. \"8.8.8.8 2001:4860:4860::8888\"), defaults to those received from the VPN server + Дополнительно + Показать дополнительные настройки + Идентификатор сервера + По умолчанию — настроенный сервер. Своё значение явно отправляется и проверяется при аутентификации + По умолчанию «%1$s». Своё значение явно отправляется и проверяется при аутентификации + Идентификатор клиента + По умолчанию — логин. Своё значение, если его ждёт сервер + По умолчанию — subject сертификата. Своё значение должно подтверждаться сертификатом + DNS-серверы + Свои DNS при подключении (через пробел, например 8.8.8.8). Иначе — с VPN-сервера MTU of the VPN tunnel device In case the default value is unsuitable for a particular network Server port @@ -105,10 +105,11 @@ Use the stronger PSS encoding instead of the classic PKCS#1 encoding for RSA signatures. Authentication will fail if the server does not support such signatures. Use IPv6 transport addresses Use IPv6 for outer transport addresses if available. Can only be enabled if UDP encapsulation for IPv6 is supported by the server. Note that the Linux kernel only supports this since version 5.8, so many servers will not support it yet. - Split tunneling - By default, the client will route all network traffic through the VPN, unless the server narrows the subnets when the connection is established, in which case only traffic the server allows will be routed via VPN (by default, all other traffic is routed as if there was no VPN). - Block IPv4 traffic not destined for the VPN - Block IPv6 traffic not destined for the VPN + Раздельное туннелирование + По умолчанию клиент направляет весь трафик через VPN, если сервер при подключении не сузит подсети — тогда через туннель идёт только разрешённый сервером трафик, остальное идёт как без VPN. + Блокировать IPv4 вне VPN + Блокировать IPv6 вне VPN + Если у сервера нет IPv6, это не даст IPv6 уйти мимо туннеля в dual-stack сети Custom subnets Only route traffic to specific subnets via VPN, everything else is routed as if there was no VPN (separated by spaces, e.g. \"192.168.1.0/24 2001:db8::/64\") Excluded subnets @@ -182,6 +183,8 @@ Статус: + Соединение + Профили Профиль: Отключить Соединение… @@ -238,4 +241,53 @@ Connect VPN Disconnect VPN + Подключение + Профили + Настройки + Не защищено + Защищено + Подключение… + Выберите профиль + Подключено + Не удалось подключиться + Профили + Поиск профилей + Ничего не найдено + Основные + Автоматизация + Сертификаты + Профили + Поддержка + Безопасность + Доверенные сети + Подключаться в мобильной сети и незнакомом Wi-Fi + Профиль автоподключения + Не выбран + Доверенные Wi-Fi сети + VPN автоматически останавливается в этих сетях. При переходе на мобильную сеть или другой Wi-Fi соединение поднимается снова. + Доверенных сетей пока нет + Добавить сеть + Добавить текущую (%1$s) + Имя сети (SSID) + Удалить доверенную сеть + Чтобы VPN отключался в доверенном Wi-Fi в фоне, разрешите доступ к геолокации «всегда». + Разрешить + Kill switch + Always-on VPN с блокировкой трафика активен + Не включён — трафик может уходить вне туннеля + Открыть настройки VPN системы + Основное + SHX VPN %1$s + Недавние + Добавить профиль + Сведения о подключении + Входящий + Исходящий + — + Длительность + Загружено %1$s, %2$s + Отправлено %1$s, %2$s + Идентификаторы, DNS, MTU, split-туннель + Импорт профиля + diff --git a/src/frontends/android/app/src/main/res/values-uk/strings.xml b/src/frontends/android/app/src/main/res/values-uk/strings.xml index a819bc83e..e69de29bb 100644 --- a/src/frontends/android/app/src/main/res/values-uk/strings.xml +++ b/src/frontends/android/app/src/main/res/values-uk/strings.xml @@ -1,242 +0,0 @@ - - - - - - strongSwan VPN клієнт - strongSwan - Перегляд журналу - Пошук - VPN не підтримуеться - Ваш пристрій не підтримує VPN.\nЗв\'яжіться з виробником. - VPN connections are not supported if a built-in VPN has the always-on feature enabled. - Unable to get permission to create VPN connections. Either because it was denied by the user, or because a different VPN app has the always-on feature enabled. - Завантаження… - Профіль не знайдено - strongSwan посилання - VPN connection state - Provides information about the VPN connection state and serves as permanent notification to keep the VPN service running in the background. - - - Settings - Default VPN profile - Connect to most recently used profile - Ignore battery optimizations - Don\'t show a warning if the app is not on the device\'s power whitelist - - - Журнал - Відправити файл журналу - Журнал порожній - strongSwan %1$s файл журналу - - - Немає VPN профілів - Додати VPN профіль - Редагувати - Copy - %1$s (Copy) - Видалити - Обрати профіль - Обрані профілі видалено - Профіль не обрано - Один профіль обрано - %1$d профілів обрано - - - Зберегти - Import - Відміна - Назва профілю (необов\'язковий) - Назва профілю - Defaults to the configured server - Defaults to \"%1$s\" - Сервер - IP address or hostname of the VPN server - VPN Тип - Логін - Пароль (необов\'язковий) - Leave blank to get prompted on demand - Сертифікат користувача - Виберіть сертифікат користувача - Вибрати спеціальний сертифікат користувача - Install user certificate - Сертифікат CA - Вибрати автоматично - Вибрати сертифікат CA - Вибрати спеціальний сертифікат CA - Advanced settings - Show advanced settings - Server identity - Defaults to the configured server. Custom values are explicitly sent to the server and enforced during authentication - Defaults to \"%1$s\". Custom values are explicitly sent to the server and enforced during authentication - Client identity - Defaults to the configured username. Custom values may be used if expected/required by the server - Defaults to the certificate\'s subject identity. Custom values may be used if expected/required by the server. Note that these usually must be confirmed by the certificate (auto-completion is provided for the certificate\'s alternative identities, if any) - DNS servers - Custom DNS servers to use when connected to the VPN (separated by spaces, e.g. \"8.8.8.8 2001:4860:4860::8888\"), defaults to those received from the VPN server - MTU of the VPN tunnel device - In case the default value is unsuitable for a particular network - Server port - UDP port to connect to, if different from the default - NAT-T keepalive interval - Small packets are sent to keep mappings on NAT routers alive if there is no other traffic. In order to save energy the default interval is 45 seconds. Behind NAT routers that remove mappings early this might be too high, try 20 seconds or less in that case. - Send certificate requests - Certificate requests are sent for all available or selected CA certificates. To reduce the size of the IKE_AUTH message this can be disabled. However, this only works if the server sends its certificate even if it didn\'t receive any certificate requests. - Use OCSP to check certificate - Use the Online Certificate Status Protocol (OCSP), if available, to check that the server certificate has not been revoked. - Use CRLs to check certificate - Use Certificate Revocation Lists (CRL), if available, to check that the server certificate has not been revoked. CRLs are only used if OCSP doesn\'t yield a result. - Use strict revocation checking - In strict mode the authentication will fail not only if the server certificate has been revoked but also if its status is unknown (e.g. because OCSP failed and no valid CRL was available). - Use RSA/PSS signatures - Use the stronger PSS encoding instead of the classic PKCS#1 encoding for RSA signatures. Authentication will fail if the server does not support such signatures. - Use IPv6 transport addresses - Use IPv6 for outer transport addresses if available. Can only be enabled if UDP encapsulation for IPv6 is supported by the server. Note that the Linux kernel only supports this since version 5.8, so many servers will not support it yet. - Split tunneling - By default, the client will route all network traffic through the VPN, unless the server narrows the subnets when the connection is established, in which case only traffic the server allows will be routed via VPN (by default, all other traffic is routed as if there was no VPN). - Block IPv4 traffic not destined for the VPN - Block IPv6 traffic not destined for the VPN - Custom subnets - Only route traffic to specific subnets via VPN, everything else is routed as if there was no VPN (separated by spaces, e.g. \"192.168.1.0/24 2001:db8::/64\") - Excluded subnets - Traffic to these subnets will not be routed via VPN, but as if there was no VPN (separated by spaces, e.g. \"192.168.1.0/24 2001:db8::/64\") - Applications - Select applications - No applications selected - One application selected - %1$d applications selected - Algorithms - Optionally configure specific algorithms to use for IKEv2 and/or IPsec/ESP instead of the defaults. Refer to our wiki for a list of algorithm identifiers (note that not all are supported by this app). Both fields take a list of algorithms, each separated by a hyphen. - IKEv2 Algorithms - For non-AEAD/classic encryption algorithms, an integrity algorithm, a pseudo random function (optional, defaults to one based on the integrity algorithm) and a Diffie-Hellman group are required (e.g. aes256-sha256-ecp256). For combined-mode/AEAD algorithms, the integrity algorithm is omitted but a PRF is required (e.g. aes256gcm16-prfsha256-ecp256). - IPsec/ESP Algorithms - For non-AEAD/classic encryption algorithms, an integrity algorithm is required, a Diffie-Hellman group is optional (e.g. aes256-sha256 or aes256-sha256-ecp256). For combined-mode/AEAD algorithms, the integrity algorithm is omitted (e.g. aes256gcm16 or aes256gcm16-ecp256). If a DH group is specified IPsec SA rekeying will use a DH key exchange. However, DH groups specified here are not used when the connection is established initially because the keys there are derived from the IKE SA key material. Therefore, any configuration mismatch with the server will only cause errors later during rekeying. - HTTP proxy server - Optional HTTP proxy server to use when connected to the VPN. This is only a recommendation and may be ignored by apps. Note that apps using the proxy will access all HTTP resources through it regardless of the destination, so split-tunneling settings might not have any effect. To avoid using the proxy server for specific hosts, use the exclusion list below. - Proxy host - IP address or hostname of the HTTP proxy server to use when connected to the VPN - Proxy port - Port to access the HTTP proxy server, defaults to 8080 - Proxy exclusion list - Optional list of hosts for which the HTTP proxy server is not used (separated by spaces, and wildcards are possible, e.g. \"direct.example.net *.example.com\") - Import VPN profile - Failed to import VPN profile - Failed to import VPN profile: %1$s - File not found - Host unknown - TLS handshake failed - Invalid value in \"%1$s\" - This VPN profile already exists, its current settings will be replaced. - This file contains a cleartext password. Remember to delete it after importing. - Import certificate from VPN profile - Certificate for \"%1$s\" - Profile ID - Managed profile - - A value is required to initiate the connection - Введіть ім\'я користувача - Не вибрано сертифікат CA - Будь ласка виберіть один Вибрати автоматично - Please enter a number in the range from %1$d - %2$d - Please enter valid subnets and/or IP addresses, separated by spaces - Please enter valid IP addresses, separated by spaces - Please enter a valid list of algorithms, separated by hyphens - This VPN profile is managed by your administrator and can\'t be modified. You can only change the password or user certificate - EAP-TNC may affect your privacy - Device data is sent to the server operator - Trusted Network Connect (TNC) allows server operators to assess the health of a client device.

For that purpose the server operator may request data such as a unique identifier, a list of installed packages, system settings, or cryptographic checksums of files.

Any data will be sent only after verifying the server\'s identity.]]> - - - Сертифікати CA - Немає сертифікатів - Перезавантажити CA сертифікати - Система - Користувач - Imported - Delete certificate? - The certificate will be permanently removed! - Import certificate - Certificate successfully imported - Failed to import certificate - CRL cache - Clear CRL cache? - The CRL cache is empty - - The CRL cache contains %1$d file (%2$s). - The CRL cache contains %1$d files (%2$s). - - Clear - - - Статус: - Профіль: - Роз\'єднати - Підключення… - Підключений - Роз\'єднання… - Немає активних VPN - Помилка - Dismiss - - - Assessment: - Restricted - Failed - View remediation instructions - - - Remediation instructions - - - Введіть пароль для з\'єднання - Логін - Пароль - Підключити - Помилка підлючення VPN: %1$s. - Помилка пошуку адреси сервер - Сервер зв\'язку зі шлюзом - Помилка перевірки данних аутентифікації сервер - Помилка аутентифікації користувача - Security assessment failed - Невідома помилка під час підключення - Password unavailable - Client certificate unavailable - VPN підключено - Цей VPN профіль зараз підключений! - Перепідключитися - Підключити %1$s? - Ця дія замінить ваше поточне VPN з\'єднання! - Disconnect VPN? - This will disconnect the active VPN connection! - Підключити - Retry - - Retry in %1$d second - Retry in %1$d seconds - - Cancel retry - Disable battery optimizations - Please confirm the next dialog to add the app to the device\'s power whitelist so it can ignore battery optimizations and schedule NAT keep-alives and rekeyings accurately in order to constantly keep reachable while the VPN is established. - User certificate required - Please edit the VPN profile to select one. - - - Toggle VPN - Connect VPN - Disconnect VPN - - diff --git a/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml b/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml index a7ad193c7..e69de29bb 100644 --- a/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml +++ b/src/frontends/android/app/src/main/res/values-zh-rCN/strings.xml @@ -1,241 +0,0 @@ - - - - - - strongSwan VPN 客户端 - strongSwan - 浏览日志 - 搜索 - 无法支持VPN - 您的设备无法支持VPN应用。\n请联系供应商。 - 如果内置VPN启用了“始终开启”功能，则不支持VPN连接。 - 无法获得创建VPN连接的权限。可能是因为用户拒绝了，或者是因为其他VPN应用程序启用了“始终打开”功能。 - 载入中… - 未找到配置 - strongSwan快捷方式 - VPN连接状态 - 提供有关VPN连接状态的信息，并作为永久通知，使VPN服务在后台运行。 - - - 设置 - 默认VPN配置文件 - 连接到最近使用的配置文件 - 忽略电池优化 - 如果应用不在设备的电源白名单上，则不显示警告 - - - 日志 - 发送日志文件 - 日志文件为空 - strongSwan %1$s 日志文件 - - - 无配置. - 添加VPN配置 - 编辑 - 拷贝 - %1$s (拷贝) - 删除 - 选择配置 - 所选配置已删除 - 未选择配置 - 已选择1项配置 - 已选择%1$d项配置 - - - 保存 - 导入 - 取消 - 配置名称 (可选) - 配置名称 - 默认为已配置服务器地址 - 默认为 \"%1$s\" - 服务器地址 - IP地址或服务器域名 - VPN类型 - 用户名 - 密码 (可选) - 留空则在要求时弹出 - 用户证书 - 选择用户证书 - 选择指定的用户证书 - 安装用户证书 - CA证书 - 自动选择 - 选择CA证书 - 选择一个指定的CA证书 - 高级设置 - 显示高级设置 - 服务器ID - 默认为已配置的服务器地址。自义定值将在鉴权期间被显式地发送至服务器 - 默认为 \"%1$s\"。自义定值将在鉴权期间被显式地发送至服务器 - 客户身份 - 默认为配置的用户名。如果服务器期望/需要，可以使用自定义值 - 默认为证书的使用者标识。如果服务器期望/需要，可以使用自定义值。请注意，这些通常必须由证书确认（证书的替代身份（如果有）提供自动完成） - DNS服务器 - 连接到VPN时要使用的自定义DNS服务器（用空格分隔，例如“8.8.8.8 2001:4860:4860:：888”），默认为从VPN服务器接收的DNS服务器 - VPN隧道设备的MTU值 - 假如在某一网络下默认值不合适 - 服务器端口 - 如不同于默认值，则所需连接的UDP端口 - NAT-T保持间隔 - 如果没有其他流量，则发送小数据包以保持NAT路由器上的映射处于活动状态。为了节省能源，默认间隔为45秒。在早期删除映射的NAT路由器后面，这可能太高，在这种情况下，尝试20秒或更短时间。 - 发送证书请求 - 为所有可用或选定的CA证书发送证书请求。要减小IKE_AUTH消息的大小，可以禁用此选项。但是，这仅在服务器发送其证书时有效，即使它没有收到任何证书请求。 - 使用OCSP检查证书 - 如果可用，请使用联机证书状态协议（OCSP）检查服务器证书是否未被吊销。 - 使用CRLs检查证书 - 如果可用，请使用证书吊销列表（CRL）检查服务器证书是否已被吊销。CRL仅在OCSP不产生结果时使用。 - 使用严格的撤销检查 - 在严格模式下，身份验证不仅在服务器证书已被吊销的情况下会失败，而且在其状态未知的情况下也会失败（例如，因为OCSP失败且没有有效的CRL可用）。 - 使用RSA/PSS签名 - 对RSA签名使用更强的PSS编码，而不是经典的PKCS#1编码。如果服务器不支持此类签名，身份验证将失败。 - 使用IPv6传输地址 - 使用IPv6作为外部传输地址（如果可用）。仅当服务器支持IPv6的UDP封装时才能启用。请注意，Linux内核仅从5.8版开始支持此功能，因此许多服务器还不支持它。 - 拆分隧道 - 默认情况下，客户端将通过VPN路由所有网络流量，除非在建立连接时服务器缩小子网，在这种情况下，只有服务器允许的流量将通过VPN路由（默认情况下，所有其他流量的路由如同没有VPN一样）。 - 屏蔽不通过VPN的IPV4流量 - 屏蔽不通过VPN的IPV6流量 - 自定义子网 - 仅通过VPN将流量路由到特定子网，其他所有内容的路由如同没有VPN一样（用空格分隔，例如“192.168.1.0/24 2001:db8:：/64”） - 排除子网 - 到这些子网的流量将不会通过VPN路由，但就好像没有VPN一样（用空格分隔，例如“192.168.1.0/24 2001:db8:：/64”） - 应用 - 选择应用程序 - 未选择任何应用程序 - 已选择一个应用程序 - %1$d 应用程序被选择 - 算法 - （可选）配置用于IKEv2和/或IPsec/ESP的特定算法，而不是默认算法。请参阅我们的wiki以了解算法标识符列表（请注意，此应用程序并不支持所有标识符）。这两个字段都包含一个算法列表，每个算法用连字符分隔。 - IKEv2算法 - 对于非AEAD/经典加密算法，需要完整性算法、伪随机函数（可选，默认为基于完整性算法的函数）和Diffie-Hellman组（例如aes256-sha256-ecp256）。对于组合模式/AEAD算法，省略完整性算法，但需要PRF（例如aes256gcm16-prfsha256-ecp256）。 - IPsec/ESP 算法 - 对于非AEAD/经典加密算法，需要完整性算法，Diffie-Hellman组是可选的（例如aes256-sha256或aes256-sha256-ecp256）。对于组合模式/AEAD算法，省略完整性算法（例如aes256gcm16或aes256gcm16-ecp256）。如果指定了DH组，IPsec SA密钥更新将使用DH密钥交换。但是，在最初建立连接时，不使用此处指定的DH组，因为其中的密钥来自IKE SA密钥材料。因此，与服务器的任何配置不匹配只会在稍后重新设置密钥时导致错误。 - HTTP proxy server - Optional HTTP proxy server to use when connected to the VPN. This is only a recommendation and may be ignored by apps. Note that apps using the proxy will access all HTTP resources through it regardless of the destination, so split-tunneling settings might not have any effect. To avoid using the proxy server for specific hosts, use the exclusion list below. - Proxy host - IP address or hostname of the HTTP proxy server to use when connected to the VPN - Proxy port - Port to access the HTTP proxy server, defaults to 8080 - Proxy exclusion list - Optional list of hosts for which the HTTP proxy server is not used (separated by spaces, and wildcards are possible, e.g. \"direct.example.net *.example.com\") - 导入VPN配置 - 导入VPN配置失败 - 导入VPN配置失败: %1$s - 文件未找到 - 未知主机 - TLS握手失败 - 无效的值： \"%1$s\" - 此VPN配置已经存在，当前设定将被覆盖。 - This file contains a cleartext password. Remember to delete it after importing. - 从VPN配置导入证书 - \"%1$s\" 所对应的证书 - 配置文件ID - Managed profile - - 必填信息以初始化连接 - 请输入您的用户名 - 未选择CA证书 - 请选择一项或激活 自动选择 - 请输入一个数字范围从%1$d到%2$d - 请输入有效的子网和/或IP地址，用空格分隔 - 请输入有效的IP地址，以空格分隔 - 请输入用连字符分隔的有效算法列表 - This VPN profile is managed by your administrator and can\'t be modified. You can only change the password or user certificate - EAP-TNC可能会影响您的隐私 - 设备数据已被发送至服务器管理员 - 可信网络连接t (TNC) 允许服务器管理员评定一个用户设备的状况。

出于此目的，服务器管理员可能要求以下数据如独立ID、已安装软件列表、系统设置、或加密过的文件校验值。

任何数据都仅将在验证过服务器的身份ID之后被发出。]]> - - - CA证书 - 无证书 - 重载CA证书 - 系统 - 用户 - 已导入 - 是否删除证书？ - 证书将被永久移除！ - 导入证书 - 证书已成功被导入 - 证书导入失败 - CRL缓存 - 清除CRL缓存？ - CRL缓存为空 - - CRL缓存包含 %1$d 个文件 (%2$s). - CRL缓存包含 %1$d 个文件 (%2$s). - - 清理 - - - 状态： - 配置： - 断开链接 - 连接中… - 已连接 - 断开连接中… - 无活跃VPN - 错误 - 不予考虑 - - - 评估详情： - 受限的 - 失败的 - 浏览修复指引 - - - 修复指引 - - - 输入密码用于连接 - 用户名 - 密码 - 连接 - 无法建立VPN：%1$s。 - 服务器地址查找失败 - 服务器地址无法连接 - 核验服务器鉴权失败 - 用户鉴权失败 - 可靠性评估失败 - 连接中遭遇未知失败 - 密码不可用 - 客户端证书不可用 - VPN已连接 - 此VPN配置目前已连接。 - 重连 - 是否连接%1$s？ - 这将覆盖您当前活跃的VPN连接！ - 断开VPN连接？ - 这将断开活动VPN连接！ - 连接 - 重试 - - %1$d s后重试 - %1$d s后重试 - - 取消重试 - 禁用电池优化 - 请确认下一个对话框，将应用程序添加到设备的电源白名单中，这样它就可以忽略电池优化，并准确地安排NAT保持有效和重新键入，以便在建立VPN时始终保持可访问性。 - User certificate required - Please edit the VPN profile to select one. - - - 切换VPN - 连接VPN - 断开VPN - - diff --git a/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml b/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml index 533167584..5829ff1ac 100644 --- a/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml +++ b/src/frontends/android/app/src/main/res/values-zh-rTW/strings.xml @@ -15,8 +15,8 @@ - strongSwan VPN 用戶端 - strongSwan + SHX VPN + SHX VPN 觀看日誌 搜尋 無法支援VPN @@ -25,7 +25,7 @@ Unable to get permission to create VPN connections. Either because it was denied by the user, or because a different VPN app has the always-on feature enabled. 載入中… 沒有找到設定檔 - strongSwan快速選單 + SHX VPN快速選單 VPN connection state Provides information about the VPN connection state and serves as permanent notification to keep the VPN service running in the background. diff --git a/src/frontends/android/app/src/main/res/values/bools.xml b/src/frontends/android/app/src/main/res/values/bools.xml new file mode 100644 index 000000000..8b1378917 --- /dev/null +++ b/src/frontends/android/app/src/main/res/values/bools.xml @@ -0,0 +1 @@ + diff --git a/src/frontends/android/app/src/main/res/values/colors.xml b/src/frontends/android/app/src/main/res/values/colors.xml index a4062e47e..043154bd2 100644 --- a/src/frontends/android/app/src/main/res/values/colors.xml +++ b/src/frontends/android/app/src/main/res/values/colors.xml @@ -1,49 +1,31 @@ - + + #FAFAFA + #0A0A0A + #737373 + #F5F5F5 + #E5E5E5 + #FFFFFF + #171717 + #FAFAFA + #15803D + #DCFCE7 + #B45309 + #FEF3C7 + #DC2626 + #FEE2E2 + #1D4ED8 + #DBEAFE - #96BDC2 - - #A2042C - - #323232 - - #D9192C - - #FF9909 - - #99CC00 - - #444444 - - #5a5a5a - - #4a4a4a - - #5a5a5a - + @color/reui_primary + @color/reui_primary + @color/reui_foreground + @color/reui_destructive + @color/reui_warning + @color/reui_success + @color/reui_frame + @color/reui_border + @color/reui_muted_bg + @color/reui_muted_bg diff --git a/src/frontends/android/app/src/main/res/values/strings.xml b/src/frontends/android/app/src/main/res/values/strings.xml index 417463606..f73caee91 100644 --- a/src/frontends/android/app/src/main/res/values/strings.xml +++ b/src/frontends/android/app/src/main/res/values/strings.xml @@ -19,8 +19,8 @@ - strongSwan VPN Client - strongSwan + SHX VPN + SHX VPN View log Search VPN not supported @@ -29,7 +29,7 @@ Unable to get permission to create VPN connections. Either because it was denied by the user, or because a different VPN app has the always-on feature enabled. Loading… Profile not found - strongSwan shortcut + SHX VPN shortcut VPN connection state Provides information about the VPN connection state and serves as permanent notification to keep the VPN service running in the background. @@ -113,6 +113,7 @@ By default, the client will route all network traffic through the VPN, unless the server narrows the subnets when the connection is established, in which case only traffic the server allows will be routed via VPN (by default, all other traffic is routed as if there was no VPN). Block IPv4 traffic not destined for the VPN Block IPv6 traffic not destined for the VPN + If the server has no IPv6, this stops IPv6 from leaking outside the tunnel on dual-stack networks Custom subnets Only route traffic to specific subnets via VPN, everything else is routed as if there was no VPN (separated by spaces, e.g. \"192.168.1.0/24 2001:db8::/64\") Excluded subnets @@ -186,6 +187,8 @@ Status: + Connection + Profiles Profile: Disconnect Connecting… @@ -242,4 +245,54 @@ Connect VPN Disconnect VPN + + Connect + Profiles + Settings + Unprotected + Protected + Connecting… + Choose a profile + Connected + Connection failed + Profiles + Search profiles + Nothing found + General + Automation + Certificates + Profiles + Support + Security + Trusted networks + Connect on cellular and untrusted Wi-Fi + Auto-connect profile + Not selected + Trusted Wi-Fi networks + The VPN is stopped automatically on these networks. It starts again on cellular or other Wi-Fi. + No trusted networks yet + Add network + Add current (%1$s) + Network name (SSID) + Remove trusted network + To pause VPN on trusted Wi-Fi in the background, allow location access all the time. + Allow + Kill switch + Always-on VPN with lockdown is active + Not enabled — traffic may leak outside the tunnel + Open system VPN settings + Basics + SHX VPN %1$s + Recents + Add profile + Connection details + Down + Up + — + Duration + Downloaded %1$s, %2$s + Uploaded %1$s, %2$s + Identifiers, DNS, MTU, split tunneling + Import profile + diff --git a/src/frontends/android/app/src/main/res/values/styles.xml b/src/frontends/android/app/src/main/res/values/styles.xml index 8dc8e4499..601545eaf 100644 --- a/src/frontends/android/app/src/main/res/values/styles.xml +++ b/src/frontends/android/app/src/main/res/values/styles.xml @@ -1,34 +1,43 @@ - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/frontends/android/app/src/test/java/org/strongswan/android/logic/autoconnect/AutoConnectManagerTest.kt b/src/frontends/android/app/src/test/java/org/strongswan/android/logic/autoconnect/AutoConnectManagerTest.kt new file mode 100644 index 000000000..6462f7521 --- /dev/null +++ b/src/frontends/android/app/src/test/java/org/strongswan/android/logic/autoconnect/AutoConnectManagerTest.kt @@ -0,0 +1,102 @@ +/* + * Copyright (C) 2026 SHX VPN + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See . + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +package org.strongswan.android.logic.autoconnect + +import org.assertj.core.api.Assertions.assertThat +import org.junit.Test +import org.strongswan.android.logic.autoconnect.AutoConnectManager.Action +import org.strongswan.android.logic.autoconnect.AutoConnectManager.Config +import org.strongswan.android.logic.autoconnect.AutoConnectManager.NetworkKind + +class AutoConnectManagerTest +{ + private val config = Config( + enabled = true, + profileUuid = "uuid-1", + trustedSsids = setOf("Home", "Office"), + ) + + @Test + fun cellularConnectsWhenVpnDown() + { + assertThat(AutoConnectManager.evaluateDecision(config, NetworkKind.CELLULAR, vpnActive = false, autoSession = false)) + .isEqualTo(Action.CONNECT) + } + + @Test + fun untrustedWifiConnectsWhenVpnDown() + { + assertThat(AutoConnectManager.evaluateDecision(config, NetworkKind.UNTRUSTED_WIFI, vpnActive = false, autoSession = false)) + .isEqualTo(Action.CONNECT) + } + + @Test + fun trustedWifiDisconnectsAutoSession() + { + assertThat(AutoConnectManager.evaluateDecision(config, NetworkKind.TRUSTED_WIFI, vpnActive = true, autoSession = true)) + .isEqualTo(Action.DISCONNECT) + } + + @Test + fun trustedWifiDisconnectsManualSession() + { + assertThat(AutoConnectManager.evaluateDecision(config, NetworkKind.TRUSTED_WIFI, vpnActive = true, autoSession = false)) + .isEqualTo(Action.DISCONNECT) + } + + @Test + fun unknownWifiKeepsExistingTunnel() + { + assertThat(AutoConnectManager.evaluateDecision(config, NetworkKind.UNKNOWN_WIFI, vpnActive = true, autoSession = true)) + .isEqualTo(Action.IGNORE) + } + + @Test + fun unknownWifiConnectsWhenVpnDown() + { + assertThat(AutoConnectManager.evaluateDecision(config, NetworkKind.UNKNOWN_WIFI, vpnActive = false, autoSession = false)) + .isEqualTo(Action.CONNECT) + } + + @Test + fun ignoresWhenVpnAlreadyActive() + { + assertThat(AutoConnectManager.evaluateDecision(config, NetworkKind.CELLULAR, vpnActive = true, autoSession = false)) + .isEqualTo(Action.IGNORE) + } + + @Test + fun ignoresWhenDisabled() + { + val disabled = config.copy(enabled = false) + assertThat(AutoConnectManager.evaluateDecision(disabled, NetworkKind.CELLULAR, vpnActive = false, autoSession = false)) + .isEqualTo(Action.IGNORE) + } + + @Test + fun ignoresWhenNoProfileSelected() + { + val noProfile = config.copy(profileUuid = null) + assertThat(AutoConnectManager.evaluateDecision(noProfile, NetworkKind.CELLULAR, vpnActive = false, autoSession = false)) + .isEqualTo(Action.IGNORE) + } + + @Test + fun ignoresWhenNetworkUnknown() + { + assertThat(AutoConnectManager.evaluateDecision(config, null, vpnActive = false, autoSession = false)) + .isEqualTo(Action.IGNORE) + } +} diff --git a/src/frontends/android/app/src/test/java/org/strongswan/android/logic/autoconnect/SsidReaderTest.kt b/src/frontends/android/app/src/test/java/org/strongswan/android/logic/autoconnect/SsidReaderTest.kt new file mode 100644 index 000000000..1f3e3618d --- /dev/null +++ b/src/frontends/android/app/src/test/java/org/strongswan/android/logic/autoconnect/SsidReaderTest.kt @@ -0,0 +1,37 @@ +/* + * Copyright (C) 2026 SHX VPN + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See . + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +package org.strongswan.android.logic.autoconnect + +import org.assertj.core.api.Assertions.assertThat +import org.junit.Test + +class SsidReaderTest +{ + @Test + fun stripsQuotes() + { + assertThat(SsidReader.normalize("\"Home\"")).isEqualTo("Home") + } + + @Test + fun rejectsUnknownPlaceholder() + { + assertThat(SsidReader.normalize("")).isNull() + assertThat(SsidReader.normalize("\"\"")).isNull() + assertThat(SsidReader.normalize("0x")).isNull() + assertThat(SsidReader.normalize("")).isNull() + assertThat(SsidReader.normalize(null)).isNull() + } +} diff --git a/src/frontends/android/build-local.ps1 b/src/frontends/android/build-local.ps1 new file mode 100644 index 000000000..8b1378917 --- /dev/null +++ b/src/frontends/android/build-local.ps1 @@ -0,0 +1 @@ + diff --git a/src/frontends/android/build-local.sh b/src/frontends/android/build-local.sh new file mode 100644 index 000000000..8b1378917 --- /dev/null +++ b/src/frontends/android/build-local.sh @@ -0,0 +1 @@ + diff --git a/src/frontends/android/build.gradle b/src/frontends/android/build.gradle index a35c5ffc3..559f02cc5 100644 --- a/src/frontends/android/build.gradle +++ b/src/frontends/android/build.gradle @@ -5,6 +5,8 @@ buildscript { } dependencies { classpath 'com.android.tools.build:gradle:8.13.0' + classpath 'org.jetbrains.kotlin:kotlin-gradle-plugin:2.1.20' + classpath 'org.jetbrains.kotlin:compose-compiler-gradle-plugin:2.1.20' } } diff --git a/src/frontends/android/gradle.properties b/src/frontends/android/gradle.properties index f8b6780ad..efd49da5e 100644 --- a/src/frontends/android/gradle.properties +++ b/src/frontends/android/gradle.properties @@ -2,3 +2,4 @@ android.enableJetifier=false android.nonFinalResIds=false android.nonTransitiveRClass=false android.useAndroidX=true +org.gradle.jvmargs=-Xmx2048m -XX:MaxMetaspaceSize=512m -Dfile.encoding=UTF-8 diff --git a/src/frontends/android/openssl/build.sh b/src/frontends/android/openssl/build.sh index fc541efb9..7432b96eb 100755 --- a/src/frontends/android/openssl/build.sh +++ b/src/frontends/android/openssl/build.sh @@ -34,7 +34,7 @@ fi : ${TAG=strongswan-android-openssl-builder} -DIR=$(dirname `readlink -f $0`) +DIR=$(cd "$(dirname "$0")" && pwd) : ${OUT=$DIR/../app/src/main/jni/openssl} mkdir -p $OUT diff --git a/src/frontends/android/openssl/compile.sh b/src/frontends/android/openssl/compile.sh index 20d344f58..e69de29bb 100755 --- a/src/frontends/android/openssl/compile.sh +++ b/src/frontends/android/openssl/compile.sh @@ -1,68 +0,0 @@ -#!/bin/bash -# -# Compile static versions of OpenSSL's libcrypto for use with strongSwan's -# Android app. -# -# Copies archives and header files to $OUT_DIR. - -set -e - -export PATH=${ANDROID_NDK_ROOT}/toolchains/llvm/prebuilt/linux-x86_64/bin:$PATH -# necessary for OpenSSL 1.1.1 -export ANDROID_NDK_HOME=${ANDROID_NDK_ROOT} - -# automatically determine the ABIs supported by the NDK -: ${ABIS=$(jq -r 'map_values(select(.default == true)) | keys | join(" ")' ${ANDROID_NDK_ROOT}/meta/abis.json)} - -# this should match APP_PLATFORM -: ${MIN_SDK=21} - -for ABI in ${ABIS} -do - -echo "## Building OpenSSL's libcrypto for ${ABI}" - -case ${ABI} in -armeabi-v7a) - OPTIONS="android-arm" - ;; -arm64-v8a) - OPTIONS="android-arm64" - ;; -x86) - OPTIONS="android-x86" - ;; -x86_64) - OPTIONS="android-x86_64" - ;; -*) - echo "!! Skipping unknown ABI '${ABI}'" - continue - ;; -esac - -OPTIONS="${OPTIONS} \ - no-shared no-ct no-cast no-comp no-dgram no-dsa no-gost no-idea \ - no-rmd160 no-seed no-sm2 no-sm3 no-sm4 no-sock no-srp no-srtp \ - no-err no-engine no-dso no-hw no-stdio no-ui-console \ - -fPIC -DOPENSSL_PIC \ - -ffast-math -O3 -funroll-loops -Wno-macro-redefined \ - -D__ANDROID_API__=${MIN_SDK} \ - " - -make distclean >/dev/null || true - -./Configure ${OPTIONS} -make -j $(nproc) build_generated >/dev/null -make -j $(nproc) libcrypto.a >/dev/null - -mkdir -p ${OUT_DIR}/${ABI} -cp libcrypto.a ${OUT_DIR}/${ABI} - -done - -# The only difference between ABIs is the config header (e.g. configuration.h -# for OpenSSL 3.0), which does define the size of BN_ULONG in bn.h. -# However, the only function we use that depends on it is BN_set_word() when -# generating RSA private keys, which isn't used in the Android app. -cp -R include/ ${OUT_DIR}